A company is considering whether or not to buy cybersecurity insurance or not, and also whether or not to hire additional cybersecurity experts to harden their systems. An insurance policy that covers any possible loss up to a maximum of $10,000,000 would cost the company an annual premium of $500,000. Hiring additional cybersecurity experts would cost $500,000 per year. The probability of being attacked in any given year is 10%. The expected damage of an attack without hiring additional experts is $4M, while the expected loss with the additional experts is only $2M. Note that any insurance payout would be deducted from these losses.

a) Draw a complete decision tree for this problem, assuming the company makes a decision on insurance first, then whether to hire the experts, and only finds out after these decisions whether the attack happens or not.

b) Find the solution that maximizes the expected value.

c) Look up the phrase “moral hazard” and give a 1-2 sentence description of this problem.

d) Briefly describe how moral hazard applies to this decision problem.